Lufthansa Modern Slavery, Joerg Jaspert (ganneff) & Debian NSB Softwareentwicklung charade
10:30 Thu, 16 Oct 2025
Reprinted with permission from Daniel Pocock.
On 16 April 2002, Joerg Jaspert (joerg / ganneff) was added to the Debian keyring.
According to his LinkedIn profile, he previously worked for Maluska GmBH and credativ GmbH. In November 2006, he joined a firm called NSB Nguyen Softwareentwicklung & Beratung GmbH. On the bottom of the company web site, we see the names Van Hien Nguyen and Joerg Jaspert as official representatives of the company. Jaspert has told people he is based in Fulda, Germany and the company web site mentions Darmstadt.
On 17 April 2007, Sam Hocevar from France began his one year term as Debian Project Leader (DPL).
On 17 April 2008, a few minutes before Sam Hocevar's term as Debian Project Leader (DPL) finished, he signed an executive order simultaneously appointing Joerg Jaspert to both the FTP Master team and the Debian Account Manager team. We can think of this like the sometimes controversial executive orders that US presidents make on their final day in the Oval Office.
The date of this controversy is significant for a second reason. Not only was it the last hour of the last day of Hocevar's term but three years later, on 17 April 2011, we have the simultaneous death of Adrian von Bidder-Senn on our wedding day. On 17 April 2019, Archbishop Peter Comensoli would use his Easter message to talk about grief in the community after the conviction of Cardinal George Pell and Joerg Jaspert was attacking my family with rumours about abuse.
As it turns out, another former Debian Project Leader from Australia, Anthony AJ Towns, could see the writing on the wall back in 2008. He immediately published a message on his blog warning about the concentration of power and stepping back from future Debian involvement.
On freedom
One of the freedoms I value is the freedom to choose what you spend your time on and who you spend it with. And while I’ve spent a lot of time arguing that people in key roles in Debian still have those freedoms (hey, 2.1(1), don’t you know), reality these days seems to be otherwise. But hey, solving that quandry just requires a mail to DSA.
To folks on the core teams I’ve been involved with: it’s been a pleasure and an honour working with you; if not always, at least mostly. Best of luck, and I hope y’all accept patches.
The midnight appointment of Joerg Jaspert had been an obvious example of a social engineering attack in the eyes of AJ Towns. Sadly, many other Debian people were taken for fools and failed to realize what was at stake. Here is the first message of a long thread on the debian-private (leaked) gossip network:
Subject: Aj, can you clarify? Date: Fri, 18 Apr 2008 22:16:12 +0200 From: Amaya <amaya@debian.org> Organization: Debian - http://www.debian.org/ To: Debian Private <debian-private@lists.debian.org>
Dear brother^Wfamily^Wdeveloper community,
I simply don't get it.
Aj, you just blogged: http://azure.humbug.org.au/~aj/blog/2008/04/18#2008-04-18-on-freedom
Can you clarify what this implies for the project? What are you exactly quiting? Will you at least still be a maintainer?
With all due respect, Amaya
-- ·''`. Come, let me sing into your ear, those dancing days are gone : :' : I carry the sun in a golden cup, the moon in a silver bag `. `' `- Proudly running Debian GNU/Linux
In a previous report, we considered Jaspert's role in the Debian pregnancy cluster. In particular, after getting all these powers in Debian, Jaspert went to the International Conference on OpenSource 2009 in Taiwan where he met his future wife Pei-Hua Tseng.
They pretend that Debian is a hobby where some people seem to be free to meet romantic partners but at other times they pretend that Debian is like an employer or workplace where dating is something to be ashamed of.
As George Orwell's pigs put it so well in the book Animal Farm,
All animals are equal but some animals are more equal than others
In 2015, Jaspert went to the Ganeti / GanetiCon 2015 where he gave a talk with the title Ganeti@Lufthansa CMS .
Looking at his talk title, he chose to submit the talk proposal to the conference organizers using the well-known name of the German airline Lufthansa rather than the more obscure name of his consultancy firm NSB.
Looking in the slides, we find this:
In the slide, he tells us "I am not a Lufthansa Employee" and, by extension, we should not presume he is representing the interests of Lufthansa in his Debian roles.
Reading between the lines, when I see a statement like that where he denies being a Lufthansa employee, I can't help contemplating the possibility that NSB is getting most of their revenue from one client. NSB's web site tells us that Jaspert is in a position of managerial control. Whether Lufthansa puts money in the personal bank account of an employee or they put money into the bank account of a small business like this, the impact of that money is almost identical.
In 2019, Jaspert nominated in the elections for the post of Debian Project Leader. People asked about all the other powerful roles he has in Debian and he stated in his platform that he would resign from the Debian Account Manager role but he would not automatically resign from the FTP Master role.
However, in the same page explaining his platform, Jaspert does not tell us he is employed by NSB and he does not declare that most of his revenue appears to come from Lufthansa.
Why did he share that information about Lufthansa with the participants at GanetiCon but he did not share it with us in Debian?
The answer is in the debian-private (leaked) gossip network.
People are pretending they are poor and pretending there is no money in Debian.
Back in 2006, Jaspert had sent a strongly-worded email on the debian-private (leaked) gossip network telling people he was against paying people for work.
Subject: Re: Release management Date: Thu, 24 Aug 2006 17:58:45 +0200 From: Joerg Jaspert <joerg@debian.org> Organization: Goliath-BBS To: debian-private@lists.debian.org
On 10756 March 1977, Anthony Towns wrote:
> As DPL, I would like to request that SPI, on Debian's behalf, allocate > sufficient funds so that Steve Langasek and Andreas Barth can dedicate > a month each to getting etch out on time.
Well, in short: I'm against Debian paying *anyone* (through SPI/ffis/whatever) for work, how defined or "important" that work may be. If that gets true it's time for me to resign.
[ ... snip ... ]
[-private note: All my parts in this post (or citation of them in another) are forbidden to be made public later.]
Yet in 2022, we can see that Debian money paid $120,000 in legal fees to denounce my family after my father died. The lawyers received lavish payments and developers receive nothing. Here is the page from the financial report of Software in the Public Interest, Inc:
Before his suicide in 2010, Frans Pop had made many complaints about the influence of at least one of the controlling corporations in Debian. The word "slave" was used. After the suicide, it was Joerg Jaspert who punished other volunteers for speaking up. Did he want to hide supply chain suicides from Lufthansa?
In 2014, it was Joerg Jaspert who started the debian-private thread about a "demotion" for one of his co-authors, Daniel Baumann from Switzerland. There is no such thing as a "demotion" in a relationship between the joint authors of intellectual property. The rights of joint authors are protected by copyright law. All joint authors are equal.
This arrangement feels like a sham. Lufthansa publishes a Modern Slavery statement on their web site.
Lufthansa tells us:
Respect for human rights is self-evident and forms an integral part of the corporate culture of Lufthansa Group. Please find the modern slavery and human trafficking statements, made pursuant to section 54 of the Modern Slavery Act 2015, Forced Labor in Canadian Supply Chain Report in line with section 13 (1) of the Bill S-211, an Act to enact the Fighting Against Forced Labour and Child Labour in Supply Chains Act as well as the Policy Statement for the respect of human and environmental rights made pursuant to section 6 (2) of the German Due Diligence in Supply Chains Act.
Opening one of the documents, Modern Slavery and Human Trafficking Statement for the year 2024, we find the statement:
working conditions that are adequate and humane
Looking at the Debian web site, we find examples of the overlords complaining about "behaviour" of co-authors and competitors.
What does correct "behaviour" mean?
Joerg Jaspert is obviously worried about creating a certain impression in front of his customer Lufthansa. He wants to show them he has control, which smells like coercive control, over the "behaviour" of his co-authors. If he can control people's behaviour, without paying people, this makes him more valuable to Lufthansa and they will continue putting money in the bank account of NSB.
The GanetiCon slides reveal Jaspert's company is handling sensitive CMS data, which may include flight passenger lists and copies of identity documents or credit card details. I recently demonstrated how other Debian co-authors have complained about being blackmailed to provide personal information when they were added to the Debian keyring. Jaspert, as part of the Debian Account Managers team, is one of the people responsible for the process of demanding personal data from people.
Between 2014 and 2016, the Lufthansa pilots had a series of strikes to defend minimum standards for their pay and working conditions. Durign the strikes, they continued to wear their Lufthansa uniforms:
In 2018, when Cardinal George Pell was convicted, the newspapers tried to protect the privacy of families by obfuscating the faces in the pictures:
At the same time, Joerg Jaspert attacked my family by spreading references to abuse.
A few months later, my father died and Jaspert was elected as the parent representative in the Dalbergschule, Fulda. The Lufthansa pilots wear their employer's uniform, the priests wear their robes and Jaspert is wearing a Debian t-shirt to fool people into believing we are all volunteers and we don't have any money in Debian:
Jaspert and the other Debian Account Managers recently had some kind of discussion about the British volunteer Phil Wyett. After DebConf25 in Brest, France, they sent him more insults and he resigned with the comments:
I have tried to carry on with Debian contribution, but cannot.
Please see the chronological history of how the Debian harassment and abuse culture evolved. █